View all questions & answers for the NSE 6 - Network Security 7.6 Support Engineer Materials exam

NSE 6 - Network Security 7.6 Support Engineer Materials - Question #76 Discussion

Comment Image Comment Image Comment Image
Question Diagram

Refer to the exhibit, which contains the output of diagnose vpn tunnel list. Which command will capture ESP traffic for the VPN named DialUp_0? (Choose one answer)

  • A. diagnose sniffer packet any 'host 10.0.10.10'
  • B. diagnose sniffer packet any 'ip proto 50'
  • C. diagnose sniffer packet any 'esp and host 10.200.3.2'
  • D. diagnose sniffer packet any 'port 4500'
Correct Answer: D

Brave-Dump Community Votes

Answer: C (3 votes) 60%
Answer: D (2 votes) 40%

Community Explanations & Comments (5)

Mohammed Khaled 11 months ago
Selected: D
D is correct the tunnel is up and there is spi sessions, so the 4500 port will be used, C is not correct as i think 10.200.3.2 is a traffic selector so it will be encapsulated.
Kalanidhi Mani Tripathi 6 months ago
10.200.3.2 is not the selector traffic. The selector traffic are dst: 0:0.0.0.0-255.255.255.255:0 src:0:10.0.10.10-10.0.10.10:0
Anonymous User 6 months ago
Selected: C
Network_Security_Support_Engineer_7.6_Study_Guide 339

I feel the correct answer is option C, as it is asking for a command which will capture ESP traffic. 10.200.3.2 is not the selector traffic. The selector traffic are

dst: 0:0.0.0.0-255.255.255.255:0
src:0:10.0.10.10-10.0.10.10:0
Anonymous User 6 months ago
Selected: C
esp traffic from DiaulUp_0
Anonymous User 5 months ago
Selected: C
answer is C
Anonymous User 3 months ago
Selected: D
natt: mode=silent, so there is NAT. Study guide page 340 shows a table where ESP protocol is listed: NAT/NAT-T uses UDP port 4500, and No NAT uses protocol 50. So answer is D.